PT-2021-23977 · Humhub · Humhub

Brenu + 1 · Published 2021-12-20 · Updated 2022-08-09 · CVE-2021-43847

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: HumHub versions prior to 1.10.3 HumHub versions prior to 1.9.3

Description: HumHub is an open-source social network kit written in PHP. Prior to certain versions, it could be possible for registered users to become unauthorized members of private Spaces.

Recommendations: For versions prior to 1.10.3, update to version 1.10.3 to resolve the issue. For versions prior to 1.9.3, update to version 1.9.3 to resolve the issue.

Exploit

Fix

Improper Authorization

Missing Authorization

Weakness Enumeration

CWE-285

CWE-862

Related Identifiers

CVE-2021-43847

GHSA-F5HC-5WFR-7V74

Affected Products

Humhub

References · 9

• 🔥 https://github.com/humhub/humhub/security/advisories/GHSA-f5hc-5wfr-7v74 · Exploit
• 🔥 https://huntr.dev/bounties/943dad83-f0ed-4c74-ba81-7dfce7ca0ef2 · Exploit
• https://github.com/humhub/humhub/pull/5473 · Patch
• https://osv.dev/vulnerability/CVE-2021-43847 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43847 · Security Note
• https://github.com/humhub/humhub/releases/tag/v1.9.3 · Note
• https://github.com/humhub/humhub/releases/tag/v1.10.3 · Note
• https://t.me/cvenotify/24669 · Telegram Post
• https://t.me/cibsecurity/34309 · Telegram Post